CVE-2022-22576: OAUTH2 bearer bypass in connection re-use
What the report claims
A cached connection authenticated with OAUTH2 mechanisms can be reused by a subsequent request even if the bearer token is not correct, affecting SASL-enabled protocols like IMAP, POP3, and LDAP.
Compare with curl's recorded outcome
Known vulnerability
A real vulnerability: CVE-2022-22576 OAUTH2 bearer bypass in connection reuse
Shown for comparison after analysis. The pipeline did not see this label.
ProveIt's finding
The available evidence does not settle the report. A maintainer should investigate.
Why this finding?
- The report provides a specific patch name, concrete reproduction steps, and affected protocols that exist in the codebase (confirmed by deterministic checks).
- However, the provided curl_source does not include the connection-reuse logic (likely in lib/url.c) or the SASL/OAUTH2 bearer validation code that would confirm or contradict the missing check.
- The external source E1 shows a fragmented patch for lib/curl_sasl.c but not the URL connection-reuse parameter checks referenced in the patch name.
- A human maintainer needs to examine the connection-reuse code at the target revision to determine if the OAUTH2 bearer is validated when reusing a cached SASL connection.
What still needs checking
- The connection-reuse logic (likely in lib/url.c or lib/connect.c) that checks whether cached connection parameters match the new request, specifically for SASL/OAUTH2 bearer.
- The SASL authentication code that stores/uses conn->oauth_bearer during connection reuse.
How this analysis ran 5 claims · 0 citations verified
Checked against curl master on 2022-03-30 (a3f4d7cee9af). Dev evaluation split. Citation verification checks that a referenced line was in the evidence; it does not prove the model interpreted it correctly.
Review a draft reply to the reporter
Edit and verify before sending.
Thank you for the detailed report and patch reference. The affected protocols (IMAP, POP3, LDAP) are confirmed in the codebase. However, the connection-reuse logic that would validate the OAUTH2 bearer when reusing a cached SASL connection is not in the provided source snippets. Could you point to the specific file and function (e.g., in lib/url.c) where the connection-reuse parameter check should occur? This will help us verify the fix matches the flaw.
Inspect all claims and source code 5 claims · 1 code excerpts
Report claims
A cached connection authenticated with OAUTH2 mechanisms can be reused by a subsequent request even if the bearer is not correct
Read the reasoning
The report claims a cached OAUTH2-authenticated connection can be reused with an incorrect bearer. The referenced patch '0001-url-check-sasl-additional-parameters-for-connection-.patch' suggests the fix is in URL connection-reuse logic, but the provided curl_source only shows src/mkhelp.pl (a help-text generator). The external source E1 shows a fragmented patch diff for lib/curl_sasl.c but does not show the connection-reuse parameter checks. Without the actual connection-reuse code (likely in lib/url.c or lib/connect.c), the claim cannot be verified or contradicted from the provided material.
SASL-enabled protocols: SMPTP(S), IMAP(S), POP3(S) and LDAP(S) (openldap only)
Read the reasoning
The deterministic checks confirm IMAP, POP3, and LDAP exist in curl at the target revision. SMTP is not explicitly checked but is a standard SASL-enabled protocol in curl. The claim about affected protocols is consistent with the grounded symbols.
reuse a cached connection after authentication with a valid bearer and then send a second request with an invalid bearer
Read the reasoning
The trigger describes the reproduction steps, but the code path that would allow connection reuse without bearer validation is not in the provided source. The patch name suggests the missing check is in URL connection-reuse logic, which is not shown.
Access (read/write) unauthorized data
Read the reasoning
Impact claims about unauthorized data access depend on the flaw being real and reachable. Since the core flaw (C1) is not verifiable from the provided code, the impact cannot be assessed.
curl 'imap://server:port/path/;MAILINDEX=1' --login-options 'AUTH=OAUTHBEARER' -u user: --oauth2-bearer validbearer --next 'imap://server:port/path/;MAILINDEX=1' --login-options 'AUTH=OAUTHBEARER' -u user: --oauth2-bearer anything
Read the reasoning
The reproduction command is provided, but without the connection-reuse and SASL/OAUTH2 bearer validation code, it cannot be confirmed that the command would demonstrate the flaw.
What the report says about other projects
not addressed The patch 0001-url-check-sasl-additional-parameters-for-connection-.patch fixes this flaw.
Read the original report
Source code
| 202 | for(@out) { |
| 203 | chop; |
| 204 | |
| 205 | $new = $_; |
| 206 | |
| 207 | $outsize += length($new)+1; # one for the newline |
| 208 | |
| 209 | $new =~ s/\\/\\\\/g; |
| 210 | $new =~ s/\"/\\\"/g; |
| 211 | |
| 212 | # gcc 2.96 claims ISO C89 only is required to support 509 letter strings |
| 213 | if($outsize > 500) { |
| 214 | # terminate and make another fputs() call here |
| 215 | print ", stdout);\n fputs(\n"; |
| 216 | $outsize=length($new)+1; |
| 217 | } |
| 218 | printf("\"%s\\n\"\n", $new); |
| 219 | |
| 220 | } |